Public bug reported: A new release of tar is available for merging from Debian.
Ubuntu: 1.35+dfsg-5ubuntu1 Debian Unstable: 1.35+dfsg-6 ### New Debian Changes ### tar (1.35+dfsg-6) unstable; urgency=medium [ Johannes Schauer Marin Rodrigues ] * Team upload (salsa.debian.org/debian namespace) [ Samuel Thibault ] * debian/rules: disable Y2038 on hurd-i386 (Closes: #1078002) -- Johannes Schauer Marin Rodrigues <[email protected]> Thu, 17 Sep 2026 00:44:50 +0200 ### Old Ubuntu Delta ### tar (1.35+dfsg-5ubuntu1) stonking; urgency=medium * Merge with Debian unstable. (LP: #2163533) Remaining changes: - d/patches: + SECURITY UPDATE: File overwrite via directory traversal - debian/patches/CVE-2025-45582-*.patch: Backport openat2 support in order to jailify the extraction directory. - Addresses CVE-2025-45582 + SECURITY UPDATE: file injection via crafted archive - debian/patches/CVE-2026-5704.patch: always call skip_member() after extraction in src/extract.c, fix skim_member() to skip directory data in src/list.c, remove conditional skip_member() call from purge_directory in src/incremen.c - debian/patches/CVE-2026-5704-*.patch: address a regression that makes valid files not extract in src/list.c, tests/Makefile.am, tests/extrac32.at, tests/extrac34.at, test/testsuite.at, src/extract.c, tests/extract23, tests/extrac30.at. - debian/patches/CVE-2026-5704-5.patch: fix "Old archives with nonzero directory sizes failing to be extracted" by forcing the size to zero afor DIRTYPE in read_header() in src/list.c - Addresses CVE-2026-5704 * New changes: - d/patches: + Fix d/p/0001 line markers -- Pierre-Elliott Bécue <[email protected]> Tue, 18 Aug 2026 19:58:00 +0200 ** Affects: tar (Ubuntu) Importance: Wishlist Status: New ** Tags: dcr-merge ** Changed in: tar (Ubuntu) Importance: Undecided => Wishlist ** Changed in: tar (Ubuntu) Milestone: None => ubuntu-26.11 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2171258 Title: Merge tar 1.35+dfsg-6 from Debian for tenacious cycle To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/tar/+bug/2171258/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
